Splunk Search

Can i write a base search in another base search

renuka
Path Finder

<search id="base_query_filter">
<query>
      Index=a,sourcetype=x,eval y=A+B</query>
</search>

<search id="base_query">
<query>
index=a,sourcetype=x,eval y=A+B -(here can i consider the base_query_filter base search)
join type =inner max=0(index=b,sourtype=y)</query>
<search>

Is it possible to consider one base search in another base search id?

Thank You in advance

Renuka

Labels (1)
Tags (1)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@renuka 

 

You can try something like this.

<search id="base_query_filter">
          <query>
            Index=a,sourcetype=x,eval y=A+B
        </query>
        </search>

        <search base="base_query_filter" id="base_query">
        <query>
        join type =inner max=0(index=b,sourtype=y)</query>
        </search>

View solution in original post

kamlesh_vaghela
SplunkTrust
SplunkTrust

@renuka 

 

You can try something like this.

<search id="base_query_filter">
          <query>
            Index=a,sourcetype=x,eval y=A+B
        </query>
        </search>

        <search base="base_query_filter" id="base_query">
        <query>
        join type =inner max=0(index=b,sourtype=y)</query>
        </search>

renuka
Path Finder

@kamlesh_vaghela 

 

Thank you so much 

0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...